No sensitive payment data stored in localStorage or sessionStorage

Payment tokens (pm_*, tok_*, pi_*) stored in localStorage or sessionStorage are readable by any JavaScript on the page — same-origin scripts, browser extensions, and XSS payloads all have full access. PCI-DSS 4.0 Req 3.3 prohibits storing sensitive authentication data after authorization; CWE-312 (Cleartext Storage of Sensitive Information) and CWE-922 (Insecure Storage of Sensitive Information) both apply. OWASP A02 (Cryptographic Failures) flags browser storage as an insecure persistence layer for payment credentials. Unlike session cookies, localStorage has no expiry and persists across browser restarts, meaning a compromised token can be extracted days or weeks after the initial checkout.

Use payment tokens immediately and discard them — never persist them to browser storage. Keep in-flight payment state in React component state only.

// WRONG — token persisted in localStorage
const { paymentMethod } = await stripe.createPaymentMethod({ type: 'card', card: cardElement })
localStorage.setItem('paymentMethodId', paymentMethod.id)  // accessible to all scripts

// CORRECT — token used immediately, never stored
const { paymentMethod } = await stripe.createPaymentMethod({ type: 'card', card: cardElement })
await fetch('/api/confirm-payment', {
  method: 'POST',
  body: JSON.stringify({ paymentMethodId: paymentMethod.id }),
})
// paymentMethod.id is never written to any browser storage

If you need to persist checkout progress across page reloads, store a server-generated session reference in a Secure; HttpOnly cookie — not the payment token itself.